ebpfkit-monitor is an utility that you can use to statically analyse eBPF bytecode or monitor suspicious eBPF activity at runtime. It was specifically designed to detect
This project is not an official Datadog product (experimental or otherwise), it is just code that happens to be developed by Datadog employees as part of an independent security research project. The rootkit herein is provided for educational purposes only and for those who are willing and curious to learn about ethical hacking, security and penetration testing with eBPF.
Do not attempt to use these tools to violate the law. The author is not responsible for any illegal action. Misuse of the provided information can result in criminal charges.
- golang 1.13+
- This project was developed on an Ubuntu Focal machine (Linux Kernel 5.4)
- Kernel headers are expected to be installed in
- clang & llvm (11.0.1)
- Graphviz (to generate graphs)
- go-bindata (
go get -u github.com/shuLhan/go-bindata/...)
- To build
# ~ make
- To install
# ~ make install
ebpfkit-monitor -h to get help.
# ~ ebpfkit-monitor -h Usage: ebpfkit-monitor [command] Available Commands: graph graph generates a graphviz representation of the ELF file help Help about any command map prints information about one or multiple maps prog prints information about one or multiple programs report prints summarized information about the maps and programs start start monitoring the bpf syscall at runtime Flags: -h, --help help for ebpfkit-monitor -l, --log-level string log level (options: panic, fatal, error, warn, info, debug or trace). Set to "debug" to see bpf events. (default "info") Use "ebpfkit-monitor [command] --help" for more information about a command.
List all the program sections provided in the ELF file
# ~ ebpfkit-monitor prog --asset my_elf_file.o
Dump the bytecode of a program
# ~ ebpfkit-monitor prog --asset my_elf_file.o --section kprobe/my_program --dump
List all the programs that use the bpf_probe_write_user eBPF helper
# ~ ebpfkit-monitor prog --asset my_elf_file.o --helper BpfProbeWriteUser
List all the programs that interact with the "piped_progs" eBPF map
# ~ ebpfkit-monitor prog --asset my_elf_file.o --map piped_progs
List all the maps declared in the ELF file
# ~ ebpfkit-monitor map --asset my_elf_file.o
Monitor the bpf syscall and print events to the screen
# ~ sudo ebpfkit-monitor start --log-level debug
Monitor the bpf syscall and write the captured events in a file
# ~ sudo ebpfkit-monitor start --output /tmp
Monitor the bpf syscall, write the captured events in a file and ensure that only "bpftool" is allowed to use the "bpf" syscall
# ~ sudo ebpfkit-monitor start --output /tmp --allowed-processes "/usr/sbin/bpftool"
Generate a graph from the provided ELF file
# ~ ebpfkit-monitor graph -a my_elf_file.o INFO[2021-08-03T13:19:12Z] Graph generated: /tmp/ebpfkit-monitor-graph-4104912074 # ~ fdp -Tsvg /tmp/ebpfkit-monitor-graph-4104912074 > ./graphs/output.svg
- Move the project to BTF & CO-RE
lsmeBPF programs instead of
bpf_override_returnfor access control
- The golang code is under Apache 2.0 License.
- The eBPF programs are under the GPL v2 License.